Add profile permission overrides and orchestration provider selection

app/src/ai/agent/api.rs

@@ -144,6 +144,7 @@ pub struct RequestParams {
     /// registry. `None` when no custom router is selected.
     pub custom_model_routers: Option<warp_multi_agent_api::request::settings::CustomModelRouters>,
     pub permission_mode: crate::ai::execution_profiles::PermissionMode,
+    pub command_allowlist: Vec<String>,
     pub autonomy_level: warp_multi_agent_api::AutonomyLevel,
     pub isolation_level: warp_multi_agent_api::IsolationLevel,
     pub web_search_enabled: bool,
@@ -239,6 +240,7 @@ impl RequestParams {
             custom_model_providers: None,
             custom_model_routers: None,
             permission_mode: Default::default(),
+            command_allowlist: Vec::new(),
             autonomy_level: Default::default(),
             isolation_level: Default::default(),
             web_search_enabled: false,
@@ -448,6 +450,7 @@ impl RequestParams {
             api_keys,
             custom_model_providers,
             custom_model_routers,
+            command_allowlist: crate::ai::execution_profiles::profiles::AIExecutionProfilesModel::as_ref(app).active_profile(terminal_view_id, app).data().command_allowlist.iter().map(ToString::to_string).collect(),
             permission_mode: BlocklistAIPermissions::as_ref(app)
                 .get_permission_mode(app, terminal_view_id),
             autonomy_level,

app/src/ai/agent/api/impl.rs

@@ -35,8 +35,10 @@ pub(crate) fn prepare_direct_provider_params(
         params.orchestration_enabled,
     );
     if params.permission_mode == crate::ai::execution_profiles::PermissionMode::ReadOnly {
-        supported_tools.retain(is_read_only_tool);
-        supported_cli_agent_tools.retain(is_read_only_tool);
+        let permitted = |tool: &api::ToolType| is_read_only_tool(tool)
+            || (!params.command_allowlist.is_empty() && matches!(tool, api::ToolType::RunShellCommand | api::ToolType::ReadShellCommandOutput | api::ToolType::WriteToLongRunningShellCommand));
+        supported_tools.retain(permitted);
+        supported_cli_agent_tools.retain(permitted);
     }
     if params.should_redact_secrets {
         redaction::redact_inputs(&mut params.input);

app/src/ai/agent/api/impl_tests.rs

@@ -38,6 +38,7 @@ fn request_params_with_ask_user_question_enabled(ask_user_question_enabled: bool
         custom_model_providers: None,
         custom_model_routers: None,
         permission_mode: Default::default(),
+        command_allowlist: Vec::new(),
         autonomy_level: api::AutonomyLevel::Supervised,
         isolation_level: api::IsolationLevel::None,
         web_search_enabled: false,
@@ -217,3 +218,14 @@ fn read_only_mode_filters_even_explicit_tool_overrides() {
     assert_eq!(base, vec![api::ToolType::Grep, api::ToolType::ReadFiles]);
     assert_eq!(cli, base);
 }
+
+#[test]
+fn read_only_advertises_shell_only_when_explicit_command_approvals_exist() {
+    let mut params = request_params_with_ask_user_question_enabled(true);
+    params.permission_mode = crate::ai::execution_profiles::PermissionMode::ReadOnly;
+    params.command_allowlist = vec!["^cargo test$".to_string()];
+    let (base, _) = super::prepare_direct_provider_params(&mut params);
+    assert!(base.contains(&api::ToolType::RunShellCommand));
+    assert!(!base.contains(&api::ToolType::ApplyFileDiffs));
+    assert!(!base.contains(&api::ToolType::RunAgents));
+}